A question about microbatching and its impact on the compute_dp_sgd_privacy_statement function.

未关闭
  • 哪里不对？
#620 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
25/100
Issue 类型
文档
描述清晰度
需要澄清
活跃度
停滞
技术栈
python
领域
machine-learning, security

调研方向

首先阅读 tensorflow_privacy/privacy/analysis/compute_dp_sgd_privacy_lib.py 和 compute_dp_sgd_privacy_statement 的实现，重点关注 used_microbatching 分支及其对 noise_multiplier 的调整。将该逻辑与引用的 Section 5.6 说明以及该函数的采样假设进行比较。当文档中明确协调了 microbatching 的行为和 microbatch size 的作用，或确定了具体的不一致之处时，即可认为完成。

由索引模型根据 Issue 内容生成。

描述

Hello contributors of TensorFlow Privacy,

I am having a hard time understanding the changes to the privacy guarantee when using microbatches. I will provide an in-depth explanation of my current understanding, but there is a TLDR at the end of this post.

The function tf_privacy.compute_dp_sgd_privacy is deprecated since it assumes Poisson sampling and "does not account for doubling of sensitivity with microbatching."
The documentation of the new function, compute_dp_sgd_privacy_statement, points to ("How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacy", https://arxiv.org/abs/2303.00654, Sec 5.6.) for further explanation.

The basic modifications of microbatching are:
- Clip the average per microbatch gradient to clipping norm C.
- Sum the averaged per-microbatch gradients.
- Add noise proportional to the clipping norm and noise multiplier.
- Divide by the number of microbatches.

However, the chapter also mentions how exactly the privacy guarantee changes when using microbatching. Most notably, the chapter says, "...epsilon remains the same as in the no microbatching setting, but this approach adds more noise. The standard deviation used is 2k times larger, where k is the size of each microbatch."

In the code (https://github.com/tensorflow/privacy/blob/master/tensorflow_privacy/privacy/analysis/compute_dp_sgd_privacy_lib.py) microbatching mainly does the following:
if used_microbatching:
noise_multiplier /= 2

Initially this is quite confusing given the previous explanation by Ponomareva et al. I thought that there was some kind of mistake and that the line should read:
if used_microbatching:
noise_multiplier *= 2size_microbatches

The comments of the aforementioned Python file mention that the noise multiplier is halved to account for the doubling of sensitivity, which is described by Ponomareva et al. This would mean that we use a /2 to counteract the *2 that was introduced with microbatching. I don't understand why this is necessary. Is this done to uphold some equality?

Whatever the case might be, the paper also states that microbatching adds k times more noise. I don't think this is included anywhere in the epsilon calculation. Why is this not addressed?

There is probably something that I am overlooking or don't understand, but I can't find that thing. Is it correct that the noise multiplier just gets cut in half, or is this an oversight?

TLDR: The code for the epsilon calculation, compute_dp_sgd_privacy_statement, of TensorFlow Privacy halves the noise multiplier when microbatching is enabled. This correction is applied both in the case of Poisson sampling and not. According to the relvant paper ("How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacy", (https://arxiv.org/abs/2303.00654) Sec 5.6.), microbatching adds more noise to the Gaussian Mechanism of DP-SGD. Why is the noise multiplier halved? Does the number of microbatches and their size really not matter?

主要语言
Python
星标
2k
派生
477
平均合并
17 小时 24 分钟
30 天内合并 PR
4

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

tensorflow/privacy 的其他 Issue

查看 tensorflow/privacy 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。